yup it isn't a new port....
As far as i can tell, it works like this:
L2Walker connects to it's auth server (--> Verify Server), sending username,pw,stuff (--> like which Server the user wants connect to)
The Verify server sends now data back, telling the walker how it should react (process normally, giving back a Verify Fail error, etc)
This is the reason why the tunnel-workaround could be easily disabled by the WalkerCrew, they just need to check to which server-ip you want to connect, and if it isn't a official server, they can make the l2walker to not work (remotely). The Tunnel-Programm only triggers, when walker connects to the L2 login server, which doesn't happen, when the user verification fails.
A little more details:
Verify servers are vip[1-6].tt2xz.com, they run on ports 5001-5004
Traffic is encrypted with a changing key. (I think client sends the key, server sends the reply encrypted with the key from client, key could be based on the current time like in good old times from lin2rich)
Sample traffic:
Client --> Server
Code:
0000 70 00 00 00 70 D4 80 54 39 33 33 34 37 33 35 44 p...p.T9334735D
0010 37 43 31 38 41 45 43 31 44 35 34 34 34 38 35 37 7C18AEC1D5444857
0020 41 41 42 46 39 46 42 00 13 2A 18 16 89 11 C8 C3 AABF9FB..*.....
0030 22 4B 9C F7 B1 C4 C6 B6 9B 2E 66 1E 3D 97 0F 93 "K........f.=..
0040 27 69 70 DE C0 ED 76 85 6A 75 4A 2A 7F ED 0A EF 'ip...v..juJ...
0050 CE 79 68 DF AA 17 06 81 CE 79 68 DF AA 17 06 81 .yh.....yh....
0060 CE 79 68 DF AA 17 06 81 CE 79 68 DF AA 17 06 81 .yh.....yh....
Response Server -> Client
Code:
0000 00 01 00 00 54 28 68 3D A2 02 32 40 56 61 87 08 ....T(h=..2@Va.
0010 06 A0 72 57 F5 8A 71 4A C7 7F 6D 24 44 37 1D 54 ..rW.qJm$D7.T
0020 CC 2F 8E B9 7F 52 8C 0B FC A1 A7 D1 D7 81 6C 10 ./R......l.
0030 FC A1 A7 D1 D7 81 6C 10 FC A1 A7 D1 D7 81 6C 10 .....l......l.
0040 FC A1 A7 D1 D7 81 6C 10 FC A1 A7 D1 D7 81 6C 10 .....l......l.
0050 FC A1 A7 D1 D7 81 6C 10 FC A1 A7 D1 D7 81 6C 10 .....l......l.
0060 FC A1 A7 D1 D7 81 6C 10 FC A1 A7 D1 D7 81 6C 10 .....l......l.
0070 43 FC 6A DA 18 86 BC DA 8A 7B 85 84 D3 16 66 57 C.j....{ ..fW
0080 0E EA CD 9B 07 C4 2E 6E DF 0B 46 99 A4 60 F4 D0 .......n..F..`..
0090 DE BE FD 13 42 FF 97 06 FF FB C8 38 DF 91 D7 F5 ....B......8...
00A0 29 7F E3 99 82 6A 9D C2 21 97 95 A1 63 8A A7 F0 ..j..!..c..
00B0 AB 5E 31 B9 3A AB 72 C5 12 A0 04 C3 A7 14 43 E1 .^1.:.r.......C.
00C0 E0 E6 BE 2D A2 E3 F1 44 D8 2F E6 D4 4F 8B 5C 0C ...-...D./..O\.
00D0 4D FE 3E 97 C7 0A 76 35 89 7D E2 C2 02 C9 22 ED M.>...v5}....".
00E0 FE 9E F2 6D DC 5F 1B A1 C9 F6 F2 AF 58 4F 27 37 ...m._......XO'7
00F0 AF B7 44 95 0C 79 81 DF 72 8F F5 C9 2F C7 48 CE ..D.y.r../.H.
Possible Solutions:
* Break Encryption, write an own verify-server
* Patch l2walker so that it takes "fail"-packets as "success"-packets
Anyways, if anyone (and i'm sure there are some...) is looking into this aswell, let's make some brainstorming :)